slon4-a--t[.]ru

This domain, slon4-a--t.ru, was registered through the REGRU-RU registrar on March 18, 2026. The authoritative name servers listed are elijah.ns.cloudflare.com (twice) and emely.ns.cloudflare.com (twice), indicating use of Cloudflare's DNS infrastructure. DNS resolution points to the IPv4 address 198.13.158.7, which is currently the only observed host for the domain. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that external mitigation services consider it malicious.

VirusTotal analysis shows that 3 of 91 scanned security vendors flagged the domain, providing independent confirmation of its suspicious nature. No additional public intelligence such as SSL certificate details, HTTP response codes, or page titles has been published, leaving those vectors unverified. The limited detection surface—registrar information, Cloudflare name servers, single blocklist entry, and a modest VirusTotal detection rate—suggests a nascent phishing campaign that may still be expanding its infrastructure.

Defenders should add 198.13.158.7 to network deny lists, enforce DNS filtering for slon4-a--t.ru, and monitor Cloudflare name‑server queries for related subdomains. Continuous re‑scanning on VirusTotal and periodic checks of blocklist status are recommended to capture any escalation in detection counts. Until further payload or page‑content analysis becomes available, the domain should be treated as actively malicious and blocked at perimeter and endpoint layers.